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We describe a quantum key distribution protocol based on pairs of entangled qubits that generates 
a secure key between two partners in an environment of unknown and slowly varying reference 
frame. A direction of particle delivery is required, but the phases between the computational basis 
states need not be known or fixed. The protocol can simplify the operation of existing setups and 
has immediate applications to emerging scenarios such as earth-to-satellite links and the use of 
integrated photonic waveguides. We compute the asymptotic secret key rate for a two-qubit source, 
which coincides with the rate of the six-state protocol for white noise. We give the generalization of 
the protocol to higher-dimensional systems and detail a scheme for physical implementation in the 
3 dimensional qutrit case. 




Introduction. — Technologies based on the principles 
of quantum information 1] promise a revolution in in- 
formational tasks such as computer processing [3, 0] and 
communication Secure communication via quantum 
key distribution (QKD) is one quantum information ap- 
plication that can be realized with current technologies 
[5|-y. All the photonic QKD protocols proposed to date 
have in common the need for a shared reference frame 
between the authorized partners Alice and Bob: align- 
ment of polarization states for polarization encoding, in- 
terferometric stability for phase encoding. This require- 
ment can in principle be dispensed with by encoding lo- 
gical qubits in larger-dimensional many-photon physical 
systems However, the creation, manipulation and de- 
tection of many-photon entangled states, are both tech- 
nically challenging and very sensitive to the losses on 
the Alice-Bob channel — in a word, impractical. To 
date, therefore, all practical implementations of QKD 
within an environment of varying phase, have required 
the frames of Alice and Bob to be actively aligned by 
classical communication. 

In this paper, we present a reference frame independ- 
ent (rfi) protocol that can be implemented with ordin- 
ary sources and operate without frame alignment, bey- 
ond the obvious establishment of a particle delivery link. 
Moreover, there are at least two emerging scenarios in 
QKD that will benefit from an rfi implementation (Fig- 
ure The first such scenario is earth-to- satellite QKD 
[1Ch18| |. In this case, one axis of the reference frame 
is well defined: the beam must obviously connect the 
earth station with the satellite. On this beam, informa- 
tion encoded in circular polarization is very stable, but 
the linear polarizations may vary in time because the 
satellite may be rotating with respect to the ground sta- 
tion. The second scenario is path encoded chip-to-chip 
QKD. The monolithic structures of planar waveguides 
have been successfully used to perform the stable inter- 
ferometric measurements required in time and phase en- 
coded QKD [lil - E^ . More recently integrated quantum 




Figure 1: (Color online) Two meaningful scenarios for refer- 
ence frame independent QKD. (1) Polarization encoding in 
earth-to-satellite quantum communication. Here, the circular 
polarisation states are stable, but the linear states can vary 
with the rotation of the satellite. (2) Path encoding in chip- 
to-chip quantum communication. While the path information 
is stable, the unpredictable wavelength-scale changes in rel- 
ative path length amount to a varying reference frame. This 
may occur between chips communicating through free space, 
or between chips connected by optical fibres. 

photonic circuits have demonstrated their potential as 
components for more general quantum information tasks 
13- 3. In these latter cases path encoding is typic- 
ally used, enabling deterministic single photon manip- 
ulations, in contrast to the probabilistic manipulations 
used in time bin encoding. In a path encoded chip-to- 
chip setup, the "which path" information is very stable. 
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but it is unthinkable to expect interferometric stability 
between two separate channels connecting the Alice and 
Bob chips. In these and similar scenarios, our protocol 
leads to the generation of a secure key without aligning 
the frames, as long as the repetition rate of the signals is 
faster than the rate of change of frame. 

The protocol for two qubits. — For ease of notation, 
we denote by {X, Y, Z} the three Pauli matrices usually 
written {<Jx,cry,az}- We assume that one direction is 
well defined, which is the case for all the usual encodings 
in QKD: the circular basis in polarization encoding, the 
time basis in time-bin encoding, the which-path basis in 
path encoding. So we set Za = Zb- The other two 
directions are related by Xb — cos I3Xa + sin /3Ya and 
Yb — cos (3Ya — sin /3Xa , where /3 may vary in time. 

We present the protocol in its entanglement-based ver- 
sion where Alice and Bob share the state pab, which 
in the ideal case is the \(f>~^) Bell state; an equivalent 
prepare-and-measure version can be obtained through 
the usual recipe (see e.g. II.B.2 in 0) 

In each run, Alice and Bob choose independently one 
of the three directions (randomly but not necessarily with 
the same probability) and measure the quantum signal 
they receive in the corresponding basis. At the end of 
the signal exchange, they reveal their bases. The raw key 
consists of the cases where both have measured in the Z 
basis; so the quantum bit error rate is given by 



Q = 



1 - {ZaZb) 



(1) 



In order to estimate Eve's knowledge, Alice and Bob need 
to use the information collected on the bases comple- 
mentary to Z. The quantity 



C = {XaXb^ + {XaYbY' 
+ {YaXb)^ + {YaYbY 



(2) 
(3) 



is independent of the relative angle f3 and will be used to 
bound Eve's knowledge. The maximal value under Pauli 
algebra is C = 2, achievable only by (a subset of) two- 
qubit maximally entangled states — note that, in this 
case, one has Q = as well: the two parameters C and 
Q are not independent, as we shall see in more detail 
later. 

Before turning to a formal security proof, it is import- 
ant to understand how the protocol is affected by the fact 
that /3 may vary in time. C being a statistical quantity, 
its estimation requires several repetitions of the exper- 
iment. A variation of /? during the run will have the 
effect of smearing the estimated correlations. For the 
protocol to be useful, therefore, Alice and Bob should 
collect sufficient signals to create a key above the finite- 
size effects 2^, S^l, in a time short enough for /3 not to 
vary too much. Now, while the expected variations of /3 
should be estimated in order to assess the feasibility of 
an implementation, during the run of the protocol /3 is 



not a parameter available to Alice and Bob: its monitor- 
ing would amount to aligning the frames, which defeats 
the purpose. In the context of security assessment, any 
smearing of the correlations will be attributed to Eve's 
intervention. 

Security bound. — As we have just seen, since /? is 
not monitored by Alice and Bob, we have to assume the 
worst case scenario: /3 is fixed, known to Eve, and all the 
smearing of the correlations is due to Eve's intervention. 
We derive an asymptotic security bound against coherent 
attacks by an eavesdropper, under the assumption that 
the source produces a two-qubit state. 

As a first step, we notice that Alice and Bob process 
each pair independently of the others. This fact, together 
with the assumption that we are dealing with finite- 
dimensional systems, guarantees that we can com put e 



the bound by restricting to collective attacks [3l|, |32| 



Thus, each pair shared by Alice and Bob is supposed 
to be in the two-qubit state pab, of which Eve holds a 
purification. 

The second step consists in proving that we can con- 
sider PAB (or just p for ease of notation) to be Bell- 
diagonal in some Bell-basis known to Eve, without loss 
of generality. The proof is similar to the one presented 
in Rcfs 3^ 34 1 . First, we use the fact that C is invari- 
ant imder the transformation Xa — >■ —Xa, Ya — ^ —Ya, 
Xb — > —Xb and Yb — > —Yb- This transformation can 
be implemented on p itself as the unitary ZaZb- In the 
presence of such a symmetry, it is not restrictive to re- 
place p by p = i(/9 -t- Z aZbpZ aZb)'- indeed, if Eve can 
gain some knowledge out of p, she can gain the same 
knowledge out of Z aZbpZ aZb\ by mixing them, she can 
therefore gain at least the same knowledge, and maybe 
more because the state is more mixed. As for Alice and 
Bob, they do not notice any difference, since they are 
looking only at Q and C. So presently we have 



Pab 



-|<i>-)($+|+i/.c. 



-\^-){^+\+H.c.] (4) 



where — \ip){tp\ and the four states represent 

the usual Bell basis. For convenience of notation, 
let us caU this state p(a, 6). Now, we have C = 
2 [{pi - P2? + (M3 - Pi? + Im(a)2 + lm{bf] . There- 
fore C will be the same for the state p{—a*,—b*). By 
the same argument as above, we can then study rather 
the mixture p' = ^ [p{a,b) + p{-a* , -b*)] = p{iA,iB) 
with A = Im(a) and B = Im(6). This last state is Bell- 
diagonal: 



(5) 



fe=i 



where |$i,2) = ^(e*x|oo) ± e-*x|ll)) and |$3,4) = 
^(e*^ |01) ± e~*^ 1 10)). The parameters are related 
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as follows. Let A' = y/ {fii — ^2)^ + A"^- then Ai,2 = 
+ ^2 ± A') and cos^ X = ^ + (Mi - A*2)M'- The ex- 
pressions of A3^4 and x' are similar with 4 and B. In 
particular, C has the same value as above and now reads 

C = 2 [(Ai - A2)2 + (A3 - A4)2] . (6) 

The third step is now formally identical to the one 
for the BB84 protocol (we refer to Appendix A of 
for details). The four non- negative numbers Xj are con- 
strained by three conditions: they must sum up to 1 and 
yield the measured values of Q and C. This leaves one 
parameter free, that will be chosen as to maximize Eve's 
information. The first two constraints are taken into ac- 
count by choosing the parametrization Ai = (1 — Q)-^^^, 
A2 - (1 - Q)V' ^3 = Q^, A4 - gi^, where 
u,v [0, 1]; in which case. Eve's information reads 

Ie{Q,u,v) = (l-Q)/^(^i±^^ +Qh(^l±^y7) 

where h is binary entropy. The third constraint ^ 
reads C = 2 [(1 — Q)^u^ + Q^v"^] and we have to com- 
pute /£;(Q,C) = maxc/_B(Q,u,w). 

First note that /e(0,C) = h[{l + y/cj2)/2]. For Q > 
0, we have v{u) — a/C/2 — (1 — Q^u^ /Q; the condition 
V e [0 1] translates as u G [umin,Umax] where Umm = 
max[C/2 and Umax = Ta\n[j^yJC/2 , 1]. 

We have not found an analytical optimization for the 
whole parameter range. However, Q is expected to be 
small in a practical implementation; and for all Q < 
15.9%, one can show that -j^Ie{Q, u, v{u)) is strictly pos- 
itive between Umin and Umax, for all C; whence 

Ie{Q,C) = lE{Q,Urnax,v{u„iax)) ■ (8) 

A rapid benchmark for qubit protocols is their 
robustness to white noise. For Werner states, 
C = 2(1 — 2Q)^: assuming this relation, we find 
Ie{Q,C) = Q + (1 - Q)h[{l - 3Q/2)(1 - Q)]. This is 
exactly the same expression obtained for the six-state 
protocol 0, The corresponding secret key rate 

r = 1 — h{Q) — Ie is positive for Q < 12.62%, so well 
within the validity of ([8|). 

Extension to higher dimensions. — Several QKD 
protocols using higher-dimensional quantum systems 
(qudits) have been proposed, see e.g. [36|. In principle, 
they yield both higher key rates and larger robustness 
to noise. Qudit encoding in photonic states has been 
demonstrated using angular momentum modes [s^] or 
time-bins [sl]. However, the control of the various relat- 
ive phases (i.e. the stabilization of the reference frame) 
is very delicate: this is the reason why practical QKD 
has largely ignored higher-dimensional protocols. Even 
at the theoretical level, to our knowledge, nobody has 
explicitly computed security bounds against coherent at- 
tacks for these protocols, even if the general theoretical 
framework is in principle the same as for qubits. 



A generalization of the rfi protocol, by removing the 
need for frame alignment, may provide the benefits of 
higher-dimensional encoding without the technical prob- 
lems. Here we present such a generalization for qutrits. 
The derivation of rigorous security bounds for qudit pro- 
tocols is a challenge in itself and is left for future work. 

It is known that d -\- 1 sets of mutually unbiased bases 
(MUBs) exist for particles of dimension d, where d is 
a power prime [s^, . The joint space of any pair of 
qudits can be quantified by the (d + 1) (81 (d + 1) meas- 
urements. The protocol requires Alice and Bob to share 
an ensemble of qudit Bell states and randomly project 
their own particles onto the MUBs. Their joint compu- 
tational basis outcomes provide the d dimensional key 
which is impervious to the effects of a changing phase 
between the computational states. The joint outcomes 
of the complementary bases from the remaining d^ + 2d 
measurements are used to calculate a fixed-but-unknown 
phase invariant quantity Cd, the higher dimensional ana- 
logue of the qubit case C. 




Figure 2: (Color Online) Integrated photonic components for 
measurement in the qutrit version of reference frame inde- 
pendent QKD. (a) The state splitter chip takes an arbitrary 
qutrit input state and splits it into a superposition of two 
probabilistic copies. The reflectivity of directional couplers 
(DC) can be set to select the relative probability of the copy. 
Two directional couplers implement a Mach Zender interfer- 
ometer (MZ) with internal phase such that a photon exits 
from the path opposite to the one in which it entered, (b) A 
qutrit Hadamard chip takes a particular equal superposition 
basis and rotates to the computational basis in preparation 
for measurement, (c) Three state splitter chips are used to 
make a superposition of four probabilistic copies of the incom- 
ing states. One probabilistic copy is immediately measured 
in the computational basis while the other three are fed into 
dilTerent Hadamard chips before measurement. 
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For example, a natural operator representation of 
MUBs are the so called Weyl operators which have been 
studied in the context of entanglement 41-4^. In the 
case of the d = 3 qutrit the Weyl matrices are often 
denoted by the set of eight Ti matrices, each of which 
has a conjugate transpose twin in the set, with the same 
eigenvectors but with two permuted eigenvalues. C3 is 
calculated on the unique eigenvector half set (neglecting 
the key forming computational basis operators). With 
joint expectation values defined by e^j 
we find 



~ Tr{i 



■Pab) 



4 4 



4 -4 

EE 



(9) 



where ti is the computational basis operator and those 
operators with negative indices are the conjugate trans- 
pose twin. The maximal value is C3 = 3, achievable only 
by (a subset of) two-qutrit maximally entangled states. 

One possible physical implementation of the qutrit 
version of rfiQKD uses integrated photonic waveguides. 
The rigid monolithic structure provides phase stability 
between spatial modes, so while chip-to-chip communica- 
tion is phase-unstable, all unitaries implemented on-chip 
are highly stable. With a network of variable beam split- 
ters, or directional couplers (DCs), one can implement 
any unitary operator [4J] . A pair of maximally entangled 
qutrits can be created on a single chip via post selection 
and with the aid of ancilla photons 45, 46] ; alternatively 
one may use a spontaneous parametric down conversion 
source and select three pairs of points on the down con- 
version cone \4l\ . 

To measure the incoming qutrits, Alice and Bob each 
require a device that randomly projects onto the four 
mutually unbiased bases. This device may be assembled 
from two types of components: a state splitter and a 
qutrit Hadamard gate. The state splitter is a 3 input 
mode by 6 output mode circuit that splits the incom- 
ing signal with three directional couplers of equal re- 
fiectivity and permutes the order of modes with Mach 
Zender interferometers, as shown in Fig 2a. The qutrit 
Hadamard device, shown in Figure 2b, is composed of 
three directional couplers. In terms of Pauli matrices, 
DC2 = ^(a, + fT,)i2; DCS - ^(a, + V2ct,)oi; DC4 
= -^{cz + i^y) 12, where the modes acted upon are noted 
by the subscripts. One can confirm that DCA.DC?>.DC2 
is a matrix in the Hadamard set; all other Hadamards in 
the set are accessible by adding phases to two of the three 
modes [2^. Three state splitters and three Hadamards 
fit together to make the random projector device shown 
in Fig 2c. 

Conclusion. — We have described a protocol for 
exchange of a secure quantum key in an unknown and 
slowly varying reference frame and identified specific 
cases in which the protocol is useful. More general 
scenarios can also be envisaged, for example, rfiQKD 



may be useful in an environment of intermittent rapid 
fiuctuation where the key is exchanged during the 
periods of relative stability without the need to realign 
the reference frame. We expect further situations in 
which rfiQKD is helpful to emerge. We have provided 
a security proof for the qubit version of the protocol 
and described how the protocol can be developed into 
higher dimensions, with specific details of physical 
implementation in the qutrit case. 
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